Toronto, Canada, November 6th, 2026, CyberNewswire

Free, read-only scanner helps organizations find Linux servers and container images exposed to two actively exploited vulnerabilities in PHP and Node.js

Insignary, a global open-source security company, today released insignary-chk, a free tool that checks for PHP2Shell and Node2Shell, two recently disclosed runtime vulnerabilities affecting PHP and Node.js.

PHP2Shell refers to two vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619), each rated 9.2 (Critical) under CVSS v4.0, that can allow an unauthenticated attacker to execute code remotely.

Servers that handle web requests with PHP are at risk, including deployments using Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

The PHP Project released fixes on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier have reached end of life and no longer receive official releases.

Because the flaws sit in the runtime itself rather than in application code, code review alone cannot reveal them, so organizations also need to find PHP instances bundled inside vendor software and container images.

Node2Shell (CVE-2026-111497) is an out-of-bounds write flaw in Google’s Brotli decompression library, which Node.js bundles. Specially crafted compressed data can crash an affected application, expose its memory, or allow remote code execution.

The issue is fixed in Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js’s official end-of-life policy treats any unsupported branch (e.g., 20.x and earlier) as carrying ongoing risk once support ends, since no further security fixes are issued.

insignary-chk reflects this by design: it does not flag EOL branches like Node.js 20.x as “Likely vulnerable”; instead, it surfaces them as “Check with OS vendor” when installed from a Linux distribution package, or “Unable to determine” when installed from nodejs.org or built from source, so administrators can verify the actual patch status with their vendor or upgrade to a supported release.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both PHP2Shell and Node2Shell to its Known Exploited Vulnerabilities catalog.

insignary-chk is a single file that requires no installation or registration. It is read-only by default: it only reads files, never runs what it finds, and makes no changes unless the user chooses the –fix option.

It sends no data over the network, except when the user chooses an option that connects to an address they specify.

Because Node2Shell originates in the Brotli library, insignary-chk also checks Brotli copies outside Node.js, including the system Brotli library and Python’s brotli package.

End-of-life PHP versions are likewise flagged for review against the Linux distribution’s security advisory, or for upgrade to a supported release.

Results are ranked by priority, so teams can see at a glance which issues need urgent attention.

The report’s to-do list is sorted by urgency: “Act now” for vulnerable files in use by a running process, “Fix soon” for vulnerable software that is installed but not running, and “Review” for items that need a manual check, followed by detailed findings for each server or container image.

insignary-chk complements the Insignary Clarity product family. Insignary Clarity uses the company’s patented binary software composition analysis (SCA) to identify components and versions inside compiled applications, firmware, IT infrastructure, and container images, without requiring source code.

Insignary Clarity SC brings results from Clarity, Clarity AIR, third-party SCA tools, and imported SBOMs (software bills of materials) into one platform, and maps newly disclosed CVEs to existing SBOMs without rescanning.

Users who already run Clarity can use insignary-chk’s –clarity option to confirm its findings with binary analysis on their own Clarity server.

“PHP2Shell and Node2Shell sit in the runtime, not in application code, so reviewing source code alone won’t show whether you’re exposed,” said Taek Wan Kim, President & CEO of Insignary.

“We built insignary-chk so any organization can check its Linux servers and containers within minutes, without making changes to its systems, and focus first on the issues that matter most.”

insignary-chk is available as a free download, with no sign-up required, at www.insignary.com/free-tools/php2shell-node2shell-checker.

It runs on Linux x86_64 and checks only the three CVEs listed above. Windows, macOS, and arm64 are not yet supported.

About Insignary

Insignary Inc. is a Toronto-based cybersecurity company specializing in binary composition analysis and software supply chain security.

Its patented technology enables organizations to identify open-source software components, vulnerabilities, and software provenance directly from compiled binaries without requiring access to source code.

The company serves enterprises, governments, and software vendors worldwide and is backed by strategic investors and partners including BearingPoint in Europe, Cybertrust Japan and TechMatrix in Japan, and TMA Solutions.

Through its global partner ecosystem, Insignary supports software supply chain security initiatives across North America, Europe, and Asia. For more information, visit www.insignary.com.

Contact

Principal Solutions Architect

Jessica Lee

Insignary

jessicalee@insignary.com

The post Insignary Releases Free Insignary-Chk Tool to Detect PHP2Shell and Node2Shell Exposure appeared first on Cyber Security News.

Melbourne, Florida, November 5th, 2026, CyberNewswire

OpenMatter Network, a pioneer in decentralized infrastructure for agentic artificial intelligence, is positioning its decentralized computing platform as an alternative to massive, centralized data center development amid growing public opposition to new facilities.

The company says its approach can support continued AI adoption by enabling computing workloads to run across distributed resources rather than relying primarily on large-scale data center infrastructure.

The results of Tuesday’s midterm elections have put growing public opposition to massive data center development in the national spotlight.

However, according to OpenMatter Network, resistance to new facilities need not signal a slowdown in AI adoption. Instead, it could accelerate the transition to a computing model that reduces dependence on massive, centralized data centers.

“Voters have made it clear that they are increasingly concerned about the enormous energy demands, environmental impact and rising utility costs associated with massive data center development,” said Mike Anderson, CEO of OpenMatter Network.

“But the need to deploy agentic AI isn’t going away. Businesses don’t have to choose between advancing AI and addressing these very legitimate concerns. There is another path forward, and OpenMatter is helping make it possible.”

Across the country, communities have expressed concerns about the impact of large-scale facilities on electricity rates, water supplies, local infrastructure and the environment.

The election has brought renewed attention to those concerns and the policy choices surrounding new construction.

“The assumption that AI must be built around increasingly massive concentrations of computing power deserves to be challenged,” Anderson continued.

“Our decentralized architecture allows computing resources to be distributed across many different locations. That means organizations have another way to move forward with agentic AI as communities and policymakers reconsider the costs and consequences of building more enormous data centers.”

The OpenMatter Network platform is designed to transform widely available computing hardware into usable network resources through its distributed architecture, algorithms and verifiable computing capabilities.

By enabling independently owned computing resources to participate in a shared network, OpenMatter is working to make decentralized infrastructure a practical alternative for enterprise AI deployment.

“There’s an enormous amount of computing capacity outside the walls of traditional data centers,” said Renee Davis, co-founder and chief business officer of OpenMatter Network.

“Our technology makes it possible to bring those resources together in a verifiable network capable of supporting real-world AI workloads. Rather than concentrating computing power in a relatively small number of massive facilities, we can distribute workloads across existing resources and smaller installations, creating opportunities for a more flexible and potentially more energy-efficient approach to AI infrastructure.”

The decentralized model also offers organizations greater flexibility in where computing resources are located and how they are deployed.

This can be particularly valuable for businesses and government institutions seeking greater control over computing infrastructure, including those with requirements for data sovereignty and locally managed resources.

“The question is no longer simply how many more massive data centers we need to build,” Anderson concluded.

“It’s how we can deploy the AI capabilities businesses need without imposing unnecessary burdens on the communities where computing resources are located. Tuesday’s election results make that question more urgent than ever. OpenMatter offers a new way forward.”

About OpenMatter Network

Headquartered in Florida’s Space Coast, OpenMatter Network is building the Verifiable Trust Layer for Secure Collaboration and AI Agents. Guided by the principle “Don’t Trust Data.

Prove It.,” the company’s cryptographically verifiable architecture enables secure collaboration, governed AI behavior and mathematically verifiable execution across untrusted environments. For more information, visit www.openmatter.network.

Contact

Account Supervisor

Caleigh McDaniel

Griffin360

caleigh@griffin360.com

The post OpenMatter Network Positions Decentralized Computing as an Alternative to Data Centers for AI appeared first on Cyber Security News.

San Francisco, CA, November 3rd, 2026, CyberNewswire

Cogent Security, an applied AI cybersecurity company, reported that the PHP2Shell vulnerability exposed significant gaps in enterprise vulnerability response.

Disclosed on October 21, PHP2Shell involved two critical flaws that had remained in PHP for more than a decade.

AI-assisted research helped identify the vulnerabilities and develop working exploits in approximately one week, with attacks beginning before a patch was available. Cloudflare recorded millions of exploitation attempts that day.

According to Cogent Security’s research, by 5 p.m. Pacific, the average Fortune 500 company had patched fewer than 1% of its 2,266 affected assets.

That gap between how fast attackers move and how fast large companies respond is the problem Cogent was built to close.

The company, an applied AI lab focused on cybersecurity, has been named to the Fortune Cyber 60 for the second consecutive year.

The list, developed by Fortune with Lightspeed Venture Partners and AWS, recognizes 60 of the most important venture-backed cybersecurity startups that have yet to go public, be acquired, or reach another significant exit, grouped by stage.

Selection weighs financial performance, growth, business operations, and cybersecurity market research, and Fortune validates the final list. 

“Attackers already run like a factory. AI is finding the bugs and writing the exploits, and in some cases it’s running most of the attack,” said Vineet Edupuganti, Cogent’s co-founder and CEO.

“Most enterprises are still defending by hand, one ticket and one handoff at a time. Making this list two years in a row tells us security leaders are ready to change how that work gets done.”

The attackers built their factories first

Edupuganti borrows an analogy from manufacturing. Factories replaced the lone skilled worker with a production line, and the most advanced plants now run largely on their own while people design the line and handle the exceptions.

Offense, he argues, has already made that shift.

The data points the same way. Google’s M-Trends 2026 report estimates the mean time to exploit at negative seven days, which means exploitation now routinely begins before a fix exists.

Researchers have shown AI producing working exploits for newly published vulnerabilities in about 15 minutes, at roughly a dollar apiece. In a state-sponsored campaign that Anthropic disrupted, AI agents carried out 80 to 90% of the tactical work.

Enterprise defense still moves at the pace of its slowest handoff. When PHP2Shell landed, security teams had to find every asset running PHP, including base images and forgotten servers, then work out which were internet-facing and which the business depended on.

After that came owners, tickets, change windows, and a rescan to confirm each fix held, with every step falling to a skilled person with a tool.

Building the Defender’s Production Line

Cogent’s answer is what it calls the Cyber Defense Factory, an operating model in which AI agents take over the work that now moves by hand between security tools, while people set the policies those agents follow.

The company sells an enterprise platform for autonomous cyber defense, and its first product applies the model to vulnerability management.

The line starts with an inventory. Agents build one deduplicated record of every asset across cloud, on-premises and endpoint environments, inferring each one’s owner and business importance from systems the company already keeps.

Findings flow in from the scanners and security tools customers already run, and Cogent matches newly published vulnerabilities against its live software inventory so exposure surfaces before scanners catch up.

Agents then check whether the vulnerable software is running and reachable, and they write out the reasoning behind every priority.

Cogent groups remediation work by fix, so one patch can resolve a vulnerability across dozens of servers. Inside the autonomy zones each customer defines, agents carry out supported fixes on their own.

On managed endpoints, for instance, they write the remediation script, push it through the company’s existing endpoint management platform, and read back the results.

Changes outside those zones go to a single owner as a ticket and wait for a person’s approval, and Cogent closes the work only after the next scan confirms the fix held.

The company says the goal is for enterprises to transform their cybersecurity functions with a factory model to do 100 times more work, 100 times faster.

Most customers start with agents in an assistive role and widen their authority as the results earn trust, an approach Cogent calls progressive autonomy.

PHP2Shell gave the model a live test. Cogent’s Zero Day Response processed the advisory and mapped vulnerable assets across customer environments in an average of five minutes, days before scanner signatures were available.

Applied to the average Fortune 500 environment in Cogent’s research, the analysis cut 2,266 affected assets down to 16 that had PHP loaded at runtime, faced the internet, and supported critical business functions.

That shortlist was waiting for security teams when they sat down to start work.

A Lab With Its Own Models

Cogent describes itself as an applied AI lab that just happens to focus on defensive cybersecurity, and the label reflects how the company is built.

It is the only cybersecurity company that trains and deploys its own frontier reasoning models for security use cases.

Its domain-specific model, VR-1, has topped cybersecurity benchmarks, outperforming general-purpose frontier models on security tasks.

The model works alongside Cogent’s Context Engine, which ties each vulnerability to the assets, identities, applications, owners, and dependencies around it.

That context usually sits scattered across asset databases, ticket histories and architecture documents, and pulling it together is what lets agents judge which changes are safe to make.

“A general-purpose AI model knows a little about everything,” Edupuganti said. “When an AI agent is deciding whether a patch is safe to push to a few thousand production servers, it needs a model that has learned how vulnerabilities, exploits and enterprise systems behave, plus deep context on the company it’s protecting. Put those together and you can give agents real responsibility.”

Racing the Exploit Clock

For security leaders, Edupuganti argues, the number that matters now is the time between a vulnerability’s disclosure and a verified fix, and that window has to be shorter than the time an attacker needs to build and launch an exploit.

Cogent is betting that closing it takes a different operating model, one where security work grows with the production line rather than with headcount.

The company’s second straight appearance on the Cyber 60 suggests buyers are warming to that bet, though Edupuganti expects people to stay at the center of it.

“The most advanced factories still have people in them. They decide what the line builds and the standard it holds,” he said. “Security teams are moving into that role. They set the policy and make the judgment calls, and the agents do the work at machine speed.”

About Cogent

Cogent Security is an applied AI lab building the enterprise platform for autonomous cyber defense. Its AI agents find and fix vulnerabilities at machine speed so every enterprise can run its own Cyber Defense Factory.

Starting with autonomous vulnerability management, Cogent carries vulnerabilities from disclosure to a verified fix across cloud, on-premises, and endpoint environments, identifying exposure within minutes and confirming what attackers can reach along the way.

Customers set the policies the agents follow and decide which fixes run autonomously and which wait for approval.

Fortune 500 security teams using Cogent have reduced the exposure window for critical vulnerabilities by 97 percent.

Built by researchers and operators from Google DeepMind, Abnormal Security, and Coinbase, Cogent is backed by Greylock Partners and Bain Capital Ventures. Learn more at cogent.com.

Contact

Ignacio Ramirez

press@cogent.com

The post Cogent Security Makes the Fortune Cyber 60 for a Second Year, With a Plan to Run Cyber Defense Like a Factory appeared first on Cyber Security News.

Orlando, Florida, United States, October 20th, 2026, CyberNewswire

Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal to Turn Findings into Prioritized Patch Plans

New internal network security monitoring correlates every anomaly with deep asset intelligence; Risk Signal converts findings into verified remediation

Industrial Defender, an OT cybersecurity leader serving the global critical infrastructure industry, today released its latest version, adding internal network security monitoring (INSM) and Risk Signal.

The release builds on Industrial Defender’s decades of leadership serving NERC-CIP regulated utilities, pairing its deep endpoint visibility with network traffic monitoring, providing OT/ICS operators a single path from detection to prioritized remediation.

“Network monitoring tells you something changed. Our customers need to know what that change means and what to do next,” said George Kalavantis, Chief Executive Officer, Industrial Defender.

The FERC-approved NERC CIP-015-1 standard requires entities with high and medium impact BES Cyber Systems to monitor internal network traffic, detect and evaluate anomalies, and retain and protect the resulting data.

Built into the existing platform, the INSM solution learns each device’s baseline communications and flags deviations such as new connections, unexpected protocols, anomalous traffic volume and unknown devices communicating.

“Our platform now associates network traffic with deep endpoint intelligence to provide a more comprehensive cybersecurity,” Kalavantis said.

Each anomaly is correlated with the asset data Industrial Defender maintains, including configuration changes, vulnerabilities and risk score, so operators understand immediately what a network change means to operations.

Every review decision is captured with reviewer, timestamp and rationale, creating audit-ready evidence mapped to CIP-015 requirements.

Beyond CIP-015, INSM serves industrial control system environments across sectors like oil & gas, petrochemical processing and manufacturing, connecting rich asset data with network visibility to strengthen cybersecurity posture.

Risk Signal: Patch what matters first

Detection and visibility are only half the job. Risk Signal closes the loop by turning asset, vulnerability and network findings into action.

Building on each customer’s existing risk model, it identifies the patches and upgrades that deliver the greatest risk reduction for the least operational effort, then packages them into prioritized playbooks that publish directly into existing work-management systems.

After remediation, Risk Signal verifies each patch was applied and updates the asset’s risk score.

“The latest version of our trusted platform connects network activity with the asset intelligence we’ve engineered for two decades, and Risk Signal turns that insight into a defensible plan. It’s the shortest path from visibility to reduced risk for critical infrastructure” Kalavantis said.

Industrial Defender will demonstrate these capabilities at GridSecCon 2026 in Orlando.

About Industrial Defender

Industrial Defender provides OT and ICS cybersecurity and compliance solutions for critical infrastructure operators, including electric utilities, oil & gas, chemical, water, and manufacturing organizations.

The platform delivers continuous OT asset visibility, vulnerability management, and audit-ready compliance reporting across frameworks including NERC CIP, NIS2, IEC 62443, and NIST CSF. 

Contact

Vice President, Marketing & Communications

Bryan Mitchell

Industrial Defender

bmitchell@industrialdefender.com

202-718-5155

The post Industrial Defender Unifies Endpoint Intelligence and Network Monitoring for CIP-015, Adds Risk Signal appeared first on Cyber Security News.

San Francisco, USA, September 25th, 2026, CyberNewswire

Archipelo today announced Salmon, Execution Verification Infrastructure (EVI) for AI agents and autonomous systems, powered by a cryptographic protocol designed to make execution history verifiable.

Salmon establishes verifiable execution history and state lineage across humans, AI agents, and automation.

The launch follows the OpenAI–Hugging Face incident, in which OpenAI reported that models participating in cybersecurity evaluations circumvented isolation controls, gained internet access, exploited vulnerabilities, accessed third-party systems, collaborated and delegated work across agents, and took actions their developers did not direct.

OpenAI called the incident a “warning shot” and said sophisticated AI systems require safeguards that operate at the speed of the agents themselves.

AI agents use credentials, invoke tools, execute code, call APIs, delegate work to other agents, modify infrastructure and change production state.

As these systems operate across multiple actors and systems, the resulting state does not by itself preserve the execution history that produced it.

Salmon is designed to capture execution as signed events and record the state transitions they produce, providing machine-consumable execution evidence for investigation, detection and response, remediation, supervision and accountability across AI security, safety, control and governance systems.

Archipelo is backed by Dell Technologies Capital and technology investors including Zoom CEO Eric Yuan, Andy Bechtolsheim, Bill Tai, David Weisburd, Hack VC, Sangha Capital and Nima Capital.

Its team brings experience spanning NASA, DoD, AWS, Google, Cisco, Meta, Harvard, MIT and Berkeley.

Execution Verification for AI Security and Control

Identity establishes who or what is acting. Authorization determines what an actor may do. Runtime controls determine whether execution should proceed. Observability monitors behavior.

Execution Verification addresses a different question: What executed, and can that history be independently verified?

Salmon is designed to provide an execution evidence layer for autonomous systems.

From Execution to a Verifiable Execution Record

Salmon captures execution as signed events and records the state transitions they produce. Each event identifies the actor, action, state before, state after and cryptographic signature.

Salmon links these events into a Verifiable Execution Record, preserving the lineage between execution and resulting state.

Capture → Execution Record → State Lineage → Verification

The record produces Machine-Consumable Execution Evidence that downstream systems can verify and use automatically.

Salmon establishes the execution record. Other systems reason from it.

When execution evidence is unavailable, Salmon preserves the gap rather than manufacturing continuity.

Execution Evidence for AI Security and Safety

“You cannot control autonomous systems without verifiable evidence of their execution,” said Matthew Wise, Creator & Protocol Architect of Salmon and CEO of Archipelo.

“AI safety is becoming an execution problem. As agents gain the authority to use credentials, invoke tools, delegate actions and change production systems safety and control cannot depend only on what a model was instructed to do, permitted to do, or says it did. We need verifiable evidence of what executed and what changed. Salmon provides that missing evidence.”

“Powerful AI should not be responsible for establishing the history of its own execution. Capture the evidence when execution happens. Make it cryptographically verifiable. Let AI safety, control, security and governance systems reason from the record.”

Salmon is intended to provide structured execution evidence for machine-speed supervision, investigation, detection and response, remediation and accountability across autonomous systems.

Autonomous Systems and Execution Evidence

Verifiable execution history provides AI safety, control, security and governance systems with evidence they can use as autonomous systems execute and modify software and infrastructure.

“Agentic AI is creating a powerful tradeoff: agent autonomy and productivity also mean software systems increasingly act without direct human oversight,” said Bill Tai, investor in Archipelo.

“As AI agents gain greater authority across production systems the ability to verify what executed and what changed becomes foundational. Salmon provides the execution evidence needed to strengthen agent safety, control, and governance.”

From DevSPM to Salmon

Salmon grew out of Archipelo’s R&D work on Developer Security Posture Management and software actor attribution.

As AI evolved from assisting developers to executing actions across tools, credentials and infrastructure, Archipelo expanded its work from software actor attribution to execution history and state lineage.

DevSPM made software actors observable. Salmon makes their execution history verifiable.

About Salmon

Salmon provides verifiable execution history for autonomous multi-actor software systems.

Salmon is Execution Verification Infrastructure for autonomous systems powered by a cryptographic protocol establishing verifiable execution history and state lineage across humans, AI agents and automation.

Salmon is developed by Archipelo, Inc.

Users can learn more: salmon.systems

Contact

Stan Kapusta

Archipelo, Inc

stan@archipelo.co

The post Salmon Introduces Execution Verification Infrastructure (EVI) for Securing AI Agents and Autonomous Systems appeared first on Cyber Security News.

Stamford, CT, September 16th, 2026, CyberNewswire

Now in early access, AxoDetect runs Sigma rules in stream alerts travel to the SIEM, and full-fidelity logs land in AxoLake, a low-cost security data lake

Detection engineers do not need more detections. They need their existing detections to fire earlier, on cleaner data, without paying SIEM ingest rates for the privilege.

Announced during Splunk .conf26, AxoDetect, Axoflow’s detection component, now in early access, runs a customer’s rules directly in the pipeline, on clean, normalized security data, before anything reaches the SIEM.

The result decomposes the SIEM’s oldest bargain. Alerts travel to the SIEM. Full-fidelity logs land in AxoLake Axoflow’s low-cost security data lake that also runs on-prem.

The SIEM stops working as an expensive log management solution and becomes what analysts actually use: a SecOps workflow engine, now optional to feed in full.

Detection engineers write new Sigma rules, tune existing ones, and pick up rules from the community, in one open format that carries across tools. AxoDetect runs them in the pipeline.

What the platform adds is visibility that never lived in one place: what data is coming in, which detection each source feeds, and where a rule lacks the data it needs.

Until now, that was back-and-forth between teams detections owned by one, data by another held together with duct tape and tool-switching.

For the CISO, the champion’s win reads as a SIEM bill cut by half or more, with coverage kept intact: a global industrial company cut SIEM costs 50% and mean time to resolution 85%; a government agency cut data volume 80% and infrastructure footprint 85%.

“The SIEM became the industry’s most expensive data swamp because it was the place where we kept all of our raw data,” said Balázs Scheidler, CEO and co-founder of Axoflow and creator of syslog-ng.

“That constraint is gone. Detection belongs in the data layer, on normalized data, before the ingest meter starts. Keep your workflow in the SIEM. Send the alerts, but not your entire data estate.”

Where the platform is going: the full detection lifecycle running where the data lives, rolling out in the months ahead.

About Axoflow

Axoflow is the autonomous security data layer, collecting, processing, routing, storing, and managing data, with in-stream detection in early access.

AI-based autonomy, not just a chatbot, drives 10X faster investigations, 50% lower SIEM spend, and near-zero pipeline maintenance. From the creators of syslog-ng.

Contact

VP of Marketing

Mate Benedek

Axoflow

mate.benedek@axoflow.com

The post Axoflow Launches AxoDetect, Bringing Detection Into the Pipeline and Making the SIEM Optional appeared first on Cyber Security News.